AI System Inventory Template for the EU AI Act

The RegShelf AI System Inventory Register is an Excel workbook — the foundation document of the kit — that lists one row per AI system with fourteen columns: system name, vendor or internal, what it does, business function, your legal role (dropdown), four screening flags (user-facing, generates content, emotion recognition or biometrics, decisions about people), risk tier, applicable articles, owner, status and last-reviewed date. To be clear about what it is not: no EU-wide law obliges a private company to keep a general AI register as such. It is the practical precondition for everything the AI Act does oblige you to do — you cannot screen a system you have not listed, and you cannot assess duties for a role you have not identified.

Any company using or providing AI — which today includes AI features switched on inside ordinary SaaS: CRM lead scoring, HR screening add-ons, meeting transcription with sentiment options, chatbots and internal prototypes. The register's quick-start instructions tell you to ask each team lead rather than rely on the IT asset list, because "shadow AI" — free browser tools and personal accounts — is where undocumented risk hides. SMEs in particular need the role column: the same company can be a deployer for one system and a provider for another, and white-labelling a vendor's AI under your own name or trademark makes you the provider of that system with the full provider duty set (Article 25).

Roles are assessed per AI system and per use (Article 3(3)–(4)). Merely calling a third-party model via API does not make you a provider — but placing a downstream system on the market under your own name or trademark, or substantially modifying a high-risk system, can (Article 25(1)). Each row's screening flags then map to real duties:

• anything that might be an Article 5 prohibited practice must stop pending review — most prohibitions have applied since 2 February 2025;
• systems that interact with people or generate content usually carry Article 50 transparency duties, in force since 2 August 2026;
• high-risk candidates get preparation time until 2 December 2027 (Annex III) or 2 August 2028 (AI in Annex I regulated products).

A register like this supports compliance with those articles; no template can "satisfy" them on its own.

The workbook has three sheets:

• About — how to use the register and a five-step quick-start: list every system including shadow AI; record function and legal role; answer the four screening flags; assign a risk tier; name an owner and review date per row;
• Inventory — the 14-column register with dropdowns and five worked example rows you overwrite: a vendor API used for support drafting (deployer, transparency duty), a CV-screening tool (deployer, high-risk preparation), a white-labelled content generator (provider, Article 50(2) marking), a meeting sentiment add-on (prohibited — stopped, Article 5(1)(f)) and an internal invoice-OCR build (minimal);
• Role guide — plain-language tests for provider, deployer, importer, distributor and white-label provider, plus four "deciding in practice" rules, including the API point and the instruction to record your reasoning in the scope memo (doc 13).

Fill the Inventory sheet by interviewing team leads, not just IT. Pick a role per row using the Role guide, run every row through the prohibited practices screen, and give high-risk candidates a risk classification assessment. Review the register quarterly and re-screen whenever a system, vendor or use case changes — the review triggers are listed in the kit's compliance calendar (doc 13), to which the register attaches.